What were you trying to do that didn't work?

The auditd man page contains the following section:

       SIGCONT
              causes auditd to dump a report of internal state to /var/run/au‐
              ditd.state.

I wanted to know whether the file gets a correct SELinux label during its creation (result: it does) and whether the restorecon command changes the label (result: unfortunately it does).

Please provide the package NVR for which bug is seen:

audit-3.0.7-104.el9.x86_64
audit-libs-3.0.7-104.el9.x86_64
selinux-policy-38.1.23-1.el9.noarch
selinux-policy-targeted-38.1.23-1.el9.noarch

How reproducible:

always

Steps to reproduce

1. service auditd start
2. kill -SIGCONT `pgrep ^auditd`
3. restorecon -v /var/run/auditd.state
   Relabeled /run/auditd.state from system_u:object_r:auditd_var_run_t:s0 to system_u:object_r:var_run_t:s0
4. kill -SIGCONT `pgrep ^auditd`

Expected results

The /var/run/auditd.state file is labeled correctly and no SELinux denials appear.

Actual results

The /var/run/auditd.state file is mislabeled and the following SELinux denial appears:

----
type=AVC msg=audit(10/20/2023 10:45:49.552:325) : avc:  denied  { write } for  pid=4563 comm=auditd name=auditd.state dev="tmpfs" ino=1023 scontext=system_u:system_r:auditd_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0 
----